How to update to Windows UEFI CA 2023

Hi CatNap,

My name is Jason and I am an independent advisor and windows user.

To successfully update to the Windows UEFI CA 2023 certificate, you must ensure your system has received the required cumulative update (KB5036210 or later), and that your firmware supports Secure Boot DB updates. A reboot—sometimes two—is required after setting the registry key.

Step-by-Step: Deploying the Windows UEFI CA 2023 Certificate

1. Ensure Prerequisites Are Met

Your system must be running Windows 10 or 11 with updates from February 13, 2024 or later

Install KB5036210 or any newer cumulative update that includes the Secure Boot DB update logic Microsoft KB5036210

2. Apply the Registry Key

Run this in elevated PowerShell:

powershell

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot" -Name "AvailableUpdates" -Value 0x40

3. Trigger the Scheduled Task

Still in elevated PowerShell:

powershell

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

4. Reboot (Twice if Needed)

Reboot your system

If the certificate still hasn’t applied, reboot a second time

Some systems require two boots to complete the DB update process.

5. Verify the Certificate

Run this PowerShell command:

powershell

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

If it returns True, the update succeeded.

Troubleshooting Tips

Still returns False?

Confirm your system firmware supports Secure Boot DB updates

  Check for firmware updates from your OEM (e.g., Dell, Lenovo, ASUS)
  
     Ensure Secure Boot is **enabled** in BIOS
     
     **No** `Secure-Boot-Update` **task?**
     
        You may be missing the required update (KB5036210 or later)
        
           Run `Get-ScheduledTask -TaskName *Secure*` to confirm
           

• Still stuck?

Use Get-SecureBootUEFI to dump the full DB and manually inspect for the 2023 CA string

• Check Event Viewer → Applications and Services Logs → Microsoft → Windows → Secure-Boot-Update

KB5036210 isn't an update, it's an article.